Overview

Field Security lets you restrict who can read or edit the contents of a field (system and custom), even if the user has the permissions to view or edit a record.
Field Security Profiles control access to fields in system entities and custom entities. Example: Your Human Resources department wants to hide a custom salary field on the system user form.
Field security applies to all the methods that are used to view and update data including Reports, SDK operations, Quick Find, SQL Filtered Views, Audit Logs, etc.
A field can be enabled for Field Security in the field customization form.
After a field is enabled for field security and the entity is published, the field is secure and no user has access to the field except the users who have the System Administrator Security Role.

Field Security Profiles

Field Security Profiles specify the permissions that users and teams have on fields that are enabled for field security. You add users and teams to Field Security Profiles to set field permissions for them.
To provide access to a secured field, a user (or a team that includes the user) must be added a Field Security profile.
If a field is enabled for field security and a user does not belong to any Field Security Profiles, then the user has no permissions to the secured field.
Types of field permissions: Read: view data in the field; Update: change data in the field; Create: enter data when creating a record. The permission act independently from each other.
Users and Teams can be added to more than one Field Security Profile. The least restrictive combination applies.
CRM maintains a System Administrator Field Security Profile. This profile gives full access to all secured fields in Microsoft Dynamics CRM.

A field that is enabled for field security displays a key symbol next to the field label in the form editor, and when the form is displayed to a user (including users who have full access to the field). The key symbol is the reminder to all users that this field is secured and that some users might not have access to the field.
If a user cannot edit a field because of field security or because the field is configured on the form to be read-only, or a Business Rule or JavaScript has set the field to read-only, a padlock symbol is displayed next to the field control.
If a user does not have access to read the value in a field, the field control displays a row of asterisks, even if the field has no value.